Light

Episode #850 Quiz

It's a Log4j Christmas
Date: 2021-12-21 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Chrome patched its 16th 2021 zero-day, a V8 use-after-free. Firefox briefly broke Microsoft.com because OCSP Must Staple plus SHA-256 stapled responses were mishandled, then fixed it. Mozilla blocked Windows Cloud Clipboard syncing of Firefox passwords. Researchers showed spoofed cellular handover reports and WiFi-Bluetooth coexistence attacks enabling interception, credential theft, and code execution.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific change did Firefox 95.0.1 make to restore access to Microsoft domains after the OCSP issue described in the episode?

Question 1

What specific change did Firefox 95.0.1 make to restore access to Microsoft domains after the OCSP issue described in the episode?

It reverted Microsoft’s OCSP certificates to SHA-1 signing It switched Firefox to ignore certificate revocation checks entirely It disabled OCSP Must Staple validation for Microsoft certificates It enabled support for SHA-256 in stapled OCSP responses

Question 2: Why did Mozilla block Firefox passwords copied from about:logins from being placed into Windows Cloud Clipboard history?

Question 2

Why did Mozilla block Firefox passwords copied from about:logins from being placed into Windows Cloud Clipboard history?

Because Windows Cloud Clipboard only supports plain text notes Because copied passwords were being encrypted twice and failing to paste Because Firefox could not detect whether the clipboard was local or remote Because synced devices could expose clipboard history through Windows+V

Question 3: What was the key weakness in the cellular handover procedure that the researchers abused to strengthen Stingray-style attacks?

Question 3

What was the key weakness in the cellular handover procedure that the researchers abused to strengthen Stingray-style attacks?

The base station accepted only the strongest nearby tower regardless of policy The handset’s location reports were transmitted without any encryption at all The signal-strength reports were cryptographically protected but not content-verified The network broadcast its handoff target before authenticating the handset

Question 4: According to the episode, what did the Bluetooth/WiFi coexistence research show was possible on affected chips?

Question 4

According to the episode, what did the Bluetooth/WiFi coexistence research show was possible on affected chips?

A Bluetooth chip could disable the WiFi antenna and force airplane mode A WiFi chip could patch the Bluetooth daemon through the OS driver A WiFi chip could decrypt LTE traffic and recover SIM credentials A Bluetooth chip could extract WiFi passwords and manipulate WiFi traffic

Question 5: What did Google’s scan of Maven Central conclude about the scale of Log4Shell exposure in the Java ecosystem?

Question 5

What did Google’s scan of Maven Central conclude about the scale of Log4Shell exposure in the Java ecosystem?

About 7,000 packages were directly vulnerable and no others were affected 35,863 packages were directly or indirectly vulnerable Roughly 440,000 packages were vulnerable and 35,863 were already fixed Less than 2% of Maven Central was affected, matching prior Java advisories

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.